AutoIT Malware infected thousands of computers worldwide

A Greek security researcher discovered a strain of malware which is a combination of AutoIT software and a commercial Keylogger named Limitless Keylogger.

A few days ago security a database containing 5 million alleged Google login and password has been leaked online on a Russian cyber security internet forum. Google immediately started its investigation and discovered that huge archive of Gmail credentials didn’t come from the security data breaches, rather the accounts’ data had been stolen by phishing attacks and other illegal practices, including social engineering attacks and malware based attacks.

Recently it has been discovered a malware which infected hundreds of thousands of computers worldwide with the purpose to syphon users’ data. The malware based attack allowed bad actors to steal social and banking site credentials.

A Greek security researcher discovered a new strain of malware spread via spam email infecting rapidly a huge number of machines. The expert detected the malware while it was attacking his corporate honeypot and conducted technical analyses posting its results on a blog post. The malware appears as a combination of software AutoIT (Automate day-to-day tasks on computers) and a commercial Keylogger named “Limitless Keylogger”. The researchers highlighted the use of Limitless Keylogger to intercept every keystrokes users press and send them back to the attackers via email, meanwhile AutoIT was adopted in order to evade detection by Antivirus programs.

The use of Keylogger confirms the intention of attackers into users’ credentials for most popular web services, including Email accounts, Social Media accounts and Online Bank accounts.

The malicious file archive includes the following files:

• AutoIT script ‘update.exe’ of 331MB
• Python script to “deobfuscate” AutoIT script
• oziryzkvvcpm.AWX – Settings for AutoIT script
• sgym.VQA – Another Encrypted malware/Payload Binary

“Possibly some Indonesian hackers might have used the malicious software available on the Russian hacking forum sites”  “and the targets are well known companies from retail industry, oil, airlines etc” said the researcher.